R21xx-HP FlexFabric 11900 Layer 3 IP Services Configuration Guide

58
Ste
p
Command Remarks
3. Configure the refresh
interval.
dhcp relay client-information refresh
[ auto | interval interval ]
By default, the refresh interval
is auto, which is calculated
based on the number of total
relay entries.
Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server might also fail
to work because of exhaustion of system resources. The following methods are available to relieve or
prevent such attacks.
• To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
MAC addresses, you can limit the number of ARP entries that a Layer 3 interface can learn or MAC
addresses that a Layer 2 port can learn. You can also configure an interface that has learned the
maximum MAC addresses to discard packets whose source MAC addresses are not in the MAC
address table.
• To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
MAC address, you can enable MAC address check on the DHCP relay agent. The DHCP relay
agent compares the chaddr field of a received DHCP request with the source MAC address in the
frame header. If they are the same, the DHCP relay agent decides this request as valid and
forwards it to the DHCP server. If not, it discards the DHCP request.
A DHCP relay agent changes the source MAC address of DHCP packets before forwarding them out.
Therefore, enable MAC address check only on the DHCP relay agent directly connected to the DHCP
clients. If you enable this feature on an intermediate relay agent, it might discard valid DHCP packets
and the sending clients do not obtain IP addresses.
To enable MAC address check:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter the interface view.
interface interface-type
interface-number
N/A
3. Enable MAC address check.
dhcp relay check mac-address
By default, MAC address check
is disabled.
Configuring the DHCP relay agent to release an IP
address
Configure the relay agent to release the IP address for a relay entry. The relay agent sends a
DHCP-RELEASE message to the server and meanwhile deletes the relay entry. Upon receiving the
DHCP-RELEASE message, the DHCP server releases the IP address.
To configure the DHCP relay agent to release an IP address: